fix: installer checks containers only; the panel reads signed manifests from the registry when it has none; unsigned-updater nodes are labeled from the panel's manifests; sign node release images; release 0.3.0 [CI]

ci/release-node-images.sh

@@ -67,6 +67,8 @@ build_arch_image() {
     "$gitea_base/api/packages/justme/generic/moshiro-node/$version/$filename" -o "$archive"
   mkdir -p "$context/app" "$context/config"
   tar -xzf "$archive" -C "$work" "moshiro-$component" fleet-enroll
+  # 镜像里装的就是这个文件：它的哈希写进签名的发布清单（binaries），节点握手时上报正在运行的二进制的哈希，面板据此认「官方二进制」
+  sha256sum "$work/moshiro-$component" | cut -d' ' -f1 >> "$work/$component.hashes"
   install -m 0755 "$work/fleet-enroll" "$context/app/fleet-enroll"
   install -m 0755 "$work/moshiro-$component" "$context/app/moshiro-$component"
   : > "$context/config/.keep"
@@ -98,7 +100,7 @@ publish_index() {
   buildah manifest create "$manifest" >/dev/null
   buildah manifest add "$manifest" "docker://$image:$version-amd64" >/dev/null
   buildah manifest add "$manifest" "docker://$image:$version-arm64" >/dev/null
-  buildah manifest push --all --format oci "$manifest" "docker://$image:$version" >/dev/null
+  buildah manifest push --all --format oci --digestfile "$work/$component.digest" "$manifest" "docker://$image:$version" >/dev/null
   if [[ "$version" != *-* ]]; then
     buildah manifest push --all --format oci "$manifest" "docker://$image:latest" >/dev/null
   fi
@@ -110,7 +112,14 @@ publish_index() {
 }
 
 for component in agent probe; do
+  rm -f "$work/$component.hashes"
   build_arch_image "$component" amd64 musl-amd64
   build_arch_image "$component" arm64 musl-arm64
   publish_index "$component"
+  # 发布清单：给多架构镜像的 digest 签名（私钥只在 CI 密钥里），放进镜像仓库（<仓库>-manifest:release），面板在线时再登记一份加速。
+  # 没有配置签名密钥（例如 fork）就只发镜像、不发清单。
+  if [[ -n "${RELEASE_SIGNING_KEY:-}" ]]; then
+    digest="$(cat "$work/$component.digest")"
+    RELEASE_BINARIES="$(paste -sd, "$work/$component.hashes")"       bash "$root/ci/publish-release-offer.sh" "$component" "$image_root/moshiro-$component" "$digest" "$tag" release "$work/$component-release"
+  fi
 done